browser-qa
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources and local files that may contain instructions targeting the agent, creating a potential path for indirect prompt injection.
- Ingestion points: In SKILL.md (Step 2), the agent is instructed to fetch content from issue trackers (GitHub/GitLab) and files located in
docs/,specs/, or.scratch/directories. - Boundary markers: The instructions do not specify any delimiters or safety prompts to treat the fetched content as untrusted data rather than instructions.
- Capability inventory: In SKILL.md (Step 3), the agent uses the
agent-browserskill to drive web flows, providing a mechanism where injected instructions could potentially interact with web applications or capture data. - Sanitization: There are no mentioned mechanisms for escaping, validating, or filtering the content retrieved from issue trackers or specification files.
Audit Metadata